14 July 2006 | 15,348 views

Linux Kernel 2.6.x PRCTL Core Dump Handling – Local r00t Exploit ( BID 18874 / CVE-2006-2451 )

Check For Vulnerabilities with Acunetix

A working version of the exploit used to escalate privileges to root in the recent Debian breakin, ah another root kernel exploit.

It’s to do with the way the kernel handles file permissions (or lack of) on core dumps.

Linux kernel is prone to a local privilege-escalation vulnerability.

A local attacker may gain elevated privileges by creating a coredump file in a directory that they do not have write access to.

A successful attack may result in a complete compromise.

Linux kernel versions prior to 2.6.17.4 are vulnerable.

/*****************************************************/
/* Local r00t Exploit for: */
/* Linux Kernel PRCTL Core Dump Handling */
/* ( BID 18874 / CVE-2006-2451 ) */
/* Kernel 2.6.x (>= 2.6.13 && < 2.6.17.4) */
/* By: */
/* - dreyer (main PoC code) */
/* - RoMaNSoFt (local root code) */
/* [ 10.Jul.2006 ] */
/*****************************************************/

#include stdio.h
#include sys/time.h
#include sys/resource.h
#include unistd.h
#include linux/prctl.h
#include stdlib.h
#include sys/types.h
#include signal.h

You can download it here:

Linux Kernel 2.6.x PRCTL Core Dump Handling Exploit



Recent in Exploits/Vulnerabilities:
- Microsoft Schannel Vulnerabilty – Patch It NOW
- Serious Linux/UNIX FTP Flaw Allows Command Execution
- Microsoft Zero Day OLE Vuln Being Exploited In Powerpoint

Related Posts:
- Debian Development Machine ‘gluck’ Hacked!
- Serious Linux Kernel Vulnerability For ALL 2.4 & 2.6 Kernels
- FreeBSD Local Root Escalation Vulnerability

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,176 views
- AJAX: Is your application secure enough? - 119,189 views
- eEye Launches 0-Day Exploit Tracker - 85,082 views

Low-cost VPS Hosting

2 Responses to “Linux Kernel 2.6.x PRCTL Core Dump Handling – Local r00t Exploit ( BID 18874 / CVE-2006-2451 )”

  1. Silahsiz Kuvvetler 6 August 2006 at 1:07 am Permalink

    this exploit is not bad but it is not the best too…but you published the little part of it..it’s not whole

  2. darren 6 September 2006 at 11:46 am Permalink

    Silahsiz Kuvvetler which one do you use?